---
id: 8240
title: "Stealing unencrypted SSH-agent keys from memory"
source_domain: netspi.com
source_url: "https://www.netspi.com/blog/technical-blog/network-pentesting/stealing-unencrypted-ssh-agent-keys-from-memory/"
published_at: "2014-07-21T00:00:00Z"
tags: ["linux", "lateral-movement", "gdb", "memory-dump", "ssh-agent", "ptrace"]
phying_url: "https://phying.com/item/8240"
lang: en
---

# Stealing unencrypted SSH-agent keys from memory

## Summary

SSH-agent holds decrypted keys in memory to spare users passphrases, but root attackers can dump that memory with gdb via ptrace and reconstruct private keys, for fast pivoting to other machines.

## Intelligence Metadata

- **Sources:** netspi.com
- **Published:** 2014-07-21T00:00:00Z
- **Original:** https://www.netspi.com/blog/technical-blog/network-pentesting/stealing-unencrypted-ssh-agent-keys-from-memory/
- **Phying News:** https://phying.com/item/8240